EMAIL SAFETY DETERMINATION

• US 20080133672A1
• Filed: 12/01/2006
• Published: 06/05/2008
• Est. Priority Date: 12/01/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gillum, Eliot C.
• Granted Patent: US 8,135,780 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/23 Reliability checks, e.g. acknowledgments or fault reporting

Abstract

A computer implemented method for assisting email users recognizes deviations in characteristics of emails sent from a particular source identifier or “source ID” to a user. After one or more emails having a pattern of characteristics are received, an action on subsequent emails is performed, such as warning users when the subsequent emails received from the source ID match or don'"'"'t match the pattern. Characteristics from a particular source ID are determined based on whether the addressee reads the email from the source ID. Various levels of warning based on the characteristics identified and the deviation of any email from the characteristics of previous emails.

Claims

1. A computer implemented method for assisting email users, comprising:

recording a pattern of characteristics associated with emails sent from a sender identity;

determining whether characteristics of new emails received from the sender identity match the pattern; and

based on whether the characteristics in any email match or do not match the pattern, enabling an action on the email.

2. The computer implemented method of claim 1 wherein the action includes issuing a warning when a user views an email.

3. The computer implemented method of claim 1 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication or whether or not an email passes DomainKeys Identified Mail authentication;

whether or not an email is received from one or more Internet Protocol addresses;

one or more elements in an email header; and

/or a text characteristic in emails from the sender identity.

4. The method of claim 3 wherein warning includes a first greater severity when a pattern of matching a stronger characteristic is not matched and a lesser severity when a pattern of matching a weaker characteristic is not matched.

5. The method of claim 4 wherein the first characteristic is an email from a source identifier regularly passing Sender ID or DomainKeys Identified Mail authentication and the second characteristic is an email regularly coming from an Internet Protocol address.

6. The method of claim 1 wherein the pattern is established when at least three emails from the sender identity share the same characteristics based on whether the user reads or does not read the email.

7. The method of claim 1 wherein the sender identity comprises one or:

an email address or a group of email addresses.

8. The method of claim 1 wherein the sender identity comprises one of:

an Internet Protocol address or a group of Internet Protocol addresses.

9. The method of claim 8 wherein a group of Internet Protocol addresses results from one or more of:

a WHOIS query based on at least two known good IP addresses;

a BGP query based on at least two known good IP addresses;

a common domain part from a reverse DNS query resulting from at least two IP addresses.

10. A computer implemented method for classifying emails according to source, comprising;

monitoring emails received for a user;

extracting one or more characteristics from each email message associated with the user;

determining whether the one or more characteristics matches one or more known characteristics for a source identified in the email; and

based on said determining step, enabling an action on the email.

11. The computer implemented method of claim 10 wherein the action comprises displaying a visual indicator to indicate potential email problems to the user.

12. The computer implemented method of claim 10 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication;

whether or not an email passes DomainKeys Identified Mail authentication; and

/or whether or not an email is received from one or more Internet Protocol addresses.

13. The method of claim 10 wherein the known characteristics for a source identified in the email are established when at least two emails from the source share the same characteristics.

14. The method of claim 10 wherein the source comprises at least one of an email address or a group of email addresses.

15. The method of claim 10 wherein the source comprises one of:

an Internet Protocol address or a group of Internet Protocol addresses.

16. The method of claim 10 wherein the characteristics comprise a text characteristic in emails from the source.

17. The computer implemented method of claim 10 further including the step of automatically white-listing the email address.

18. A computer implemented method for assisting email users, comprising:

gathering email characteristics for emails from an email address directed to a user;

determining whether a new email directed to the users matches gathered email characteristics from the email address; and

upon the user viewing the new email, visually indicating to the user whether the new email matches the previously gathered characteristics.

19. The computer implemented method of claim 18 wherein the step of indicating includes indicating one of a match with previous characteristics and a non-match with previously gathered characteristics.

20. The computer implemented method of claim 18 wherein the characteristics comprise one or more of:

whether or not an email passes a Sender ID authentication;

whether or not an email passes DomainKeys Identified Mail authentication;

whether or not an email is received from one or more Internet Protocol addresses,; and

/or a recurring text pattern in emails from the source.